{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afastifymiddie/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fastify:middie:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-112712"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@fastify/middie (9.0.0-9.3.5)"],"_cs_severities":["critical"],"_cs_tags":["web-application","security-bypass","cve"],"_cs_type":"advisory","_cs_vendors":["Fastify"],"content_html":"\u003cp\u003eThe @fastify/middie middleware engine, used within the Fastify framework, contains a vulnerability (CVE-2026-112712) in versions 9.0.0 through 9.3.5. The vulnerability arises from an improper path-joining logic within the use() function. When a middleware is path-scoped and combined with a plugin scope prefix, the resulting mount path may diverge from the path recognized by the Fastify router. This issue specifically manifests when the scope prefix ends with a slash, when using array mount paths, or when mount paths are defined without a leading slash.\u003c/p\u003e\n\u003cp\u003eCrucially, when the router and the middleware engine disagree on the path, the middleware (intended for authentication, authorization, or rate limiting) is silently bypassed, but the intended route handler continues to execute. This vulnerability effectively allows an unauthenticated request to bypass security controls by targeting paths that exploit the path-mismatch. The vulnerability is resolved in @fastify/middie 9.3.6.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the bypass of security guards such as authentication, authorization, and rate-limiting. This can lead to unauthenticated access to sensitive API endpoints, potential data exfiltration, or unauthorized execution of administrative functions within the application. The severity is reflected in a CVSS v3.1 base score of 9.1, indicating a critical impact for organizations relying on middie for access control.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the @fastify/middie package to version 9.3.6 or later immediately to resolve the underlying path-joining logic issue (CVE-2026-112712).\u003c/li\u003e\n\u003cli\u003eAs an immediate, temporary mitigation, transition security authorization logic from middie-based path-scoped middleware to Fastify preHandler hooks, which execute after the router has resolved the request path.\u003c/li\u003e\n\u003cli\u003eAudit existing middleware configurations to identify instances where plugin scope prefixes or array-based mount paths are used, as these configurations are most susceptible to the path-mismatch logic.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T21:56:52Z","date_published":"2026-10-20T21:56:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fastify-middie-bypass/","summary":"A path-handling flaw in @fastify/middie versions 9.0.0 through 9.3.5 causes security middleware to be silently skipped, enabling unauthorized access to route handlers.","title":"@fastify/middie: Security middleware bypass vulnerability (CVE-2026-112712)","url":"https://feed.craftedsignal.io/briefs/2026-10-fastify-middie-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:fastify:middie:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}